CVE-2010-1530

Multiple cross-site scripting XSS vulnerabilities in the Internationalization module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with translate interface or administer blocks privileges, to inject arbitrary web script or HTML via 1 strings used in block translation or 2 the...

CVE-2010-1358

Cross-site scripting XSS vulnerability in the Bibliography Biblio module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users, with "administer biblio" privileges, to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-1358: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Bibliography Biblio module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users, with "administer biblio" privileges, to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-1303

Multiple cross-site scripting XSS vulnerabilities in the Taxonomy Filter module 6.x before 6.x-1.1 for Drupal allow remote authenticated users, with administer taxonomy permissions or create node permissions when free tagging is enabled, to inject arbitrary web script or HTML via vocabulary 1...

CVE-2010-1108

Cross-site scripting XSS vulnerability in the Control Panel module 5.x through 5.x-1.5 and 6.x through 6.x-1.2 for Drupal allows remote authenticated users, with "administer blocks" privileges, to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-1108: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Control Panel module 5.x through 5.x-1.5 and 6.x through 6.x-1.2 for Drupal allows remote authenticated users, with "administer blocks" privileges, to inject arbitrary web script or HTML via unspecified vectors...

SA-CONTRIB-2010-010 - Author Contact - Cross site scripting

The Author Contact module provides a form to contact the author of the current post. The module does not properly sanitize parts of the provided block, leading to a cross-site scripting XSS vulnerability. Such an attack may lead to a malicious user gaining full administrative access. A user must...

SA-CONTRIB-2010-006 - Bibliography Module - Cross Site Scripting

The Bibliography module enables users to manage and display lists of scholarly publications. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting XSS vulnerability. Only users with the 'administer biblio' permission are able to exploi...

CVE-2009-4559: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Submitted By module 6.x before 6.x-1.3 for Drupal allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via an input string for "submitted by" text...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, allow remote authenticated users, with "administer workflow" privileges, to inject arbitrary web script or HTML via the name of a 1 workflow or 2 workflow state...

CVE-2009-4513

Multiple cross-site scripting XSS vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, allow remote authenticated users, with "administer workflow" privileges, to inject arbitrary web script or HTML via the name of a 1 workflow or 2 workflow state...

CVE-2009-4429

Cross-site scripting XSS vulnerability in the Sections module 5.x before 5.x-1.3 and 6.x before 6.x-1.3 for Drupal allows remote authenticated users with "administer sections" privileges to inject arbitrary web script or HTML via a section name aka the Name field...

Cross site scripting

Cross-site scripting XSS vulnerability in the Locale module modules/locale/locale.module in Drupal Core 6.14, and possibly other versions including 6.15, allows remote authenticated users with "administer languages" permissions to inject arbitrary web script or HTML via the 1 Language name in...

Cross site scripting

Cross-site scripting XSS vulnerability in the Contact module modules/contact/contact.admin.inc or modules/contact/contact.module in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to inject arbitrary web script...

CVE-2009-4371

Cross-site scripting XSS vulnerability in the Locale module modules/locale/locale.module in Drupal Core 6.14, and possibly other versions including 6.15, allows remote authenticated users with "administer languages" permissions to inject arbitrary web script or HTML via the 1 Language name in...

CVE-2009-4371

Cross-site scripting XSS vulnerability in the Locale module modules/locale/locale.module in Drupal Core 6.14, and possibly other versions including 6.15, allows remote authenticated users with "administer languages" permissions to inject arbitrary web script or HTML via the 1 Language name in...

CVE-2009-4369

Cross-site scripting XSS vulnerability in the Contact module modules/contact/contact.admin.inc or modules/contact/contact.module in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to inject arbitrary web script...

CVE-2009-4371: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Locale module modules/locale/locale.module in Drupal Core 6.14, and possibly other versions including 6.15, allows remote authenticated users with "administer languages" permissions to inject arbitrary web script or HTML via the 1 Language name in...

Drupal 6.x Core XSS

The full text of this advisory can be found at http://www.madirish.net/?article=442 Description of Vulnerability: - - ----------------------------- Drupal http://drupal.org is a robust content management system CMS written in PHP and MySQL that provides extensibility through various third party...

Drupal Sections Module XSS Vulnerability

Exploit for unknown platform in category web applications ======================================== Drupal Sections Module XSS Vulnerability ======================================== The text of this announcment is also available at http://www.madirish.net/?article=440 Description of Vulnerability:...